CVE-2026-92136

Executive Summary

CVE-2026-92136 is a stored cross-site scripting (XSS) vulnerability in the Jenkins OWASP Dependency-Check Plugin, affecting version 5.6.4 and earlier. The plugin fails to escape Common Weakness Enumeration (CWE) values sourced from Dependency-Check reports before rendering them in the Jenkins UI. An attacker with Item/Configure permission can inject malicious script that executes in the browser context of any user who views the affected build or report page. Successful exploitation yields high confidentiality and integrity impact within the Jenkins session, with an overall CVSS base score of 8.0.

Technical Analysis

The OWASP Dependency-Check Plugin integrates the OWASP Dependency-Check software composition analysis tool into Jenkins. It parses Dependency-Check reports—typically XML files containing dependency and vulnerability metadata—and surfaces these findings in the Jenkins web interface (for example, on job and build result pages). Each reported vulnerable dependency is associated with one or more CWE identifiers (for example, "CWE-79"), which the plugin retrieves from the report and displays.

The core defect is an improper neutralization of user-controllable input during web page generation (CWE-79). CWE values originate from the Dependency-Check report, which an actor with Item/Configure permission can influence by altering the job configuration and the report it consumes. The plugin renders these values into the generated HTML without applying context-appropriate escaping (HTML entity encoding). Because the values are stored and later returned to other users, the issue is a stored (persistent) XSS rather than a reflected one.

On the attack side, the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack requiring low privileges and user interaction (a victim must view the affected UI), scoped to the Jenkins application, with high confidentiality and integrity impact and high availability impact per the vector.

Key technical points supported by the advisory:

• Input source: CWE values contained in Dependency-Check reports consumed by the plugin.
• Missing control: no HTML escaping at the point of rendering in the Jenkins UI.
• Privilege requirement: Item/Configure permission is sufficient to plant the malicious value.
• Trigger condition: a victim user views the page where the unescaped CWE value is rendered.
• Persistence: the payload is stored in the job/report configuration and re-rendered on subsequent views.

No specific function names, endpoints, file paths, or parameter names are available from the description; readers should not assume any particular internal code path beyond the report-to-UI rendering flow described above.

Exploitation Scenarios

Note: No public PoC or exploit code is available for CVE-2026-92136; the attack chain below is inferred from the vulnerability class (stored XSS via unescaped report data) and the stated permission requirement.

1. Reconnaissance / target identification An adversary identifies an internet- or intranet-exposed Jenkins instance that has the OWASP Dependency-Check Plugin installed at version 5.6.4 or earlier. Signature-based discovery via HTTP titles and plugin metadata can confirm the deployment. The adversary also determines whether they hold an account with Item/Configure permission on at least one item (job/pipeline).

2. Triggering the specific flaw class Using Item/Configure permission, the attacker configures (or modifies) a job so that the Dependency-Check report it processes contains a crafted CWE value embedding script markup (for example, an HTML/JavaScript payload placed where a CWE identifier is expected). Because the plugin consumes Dependency-Check reports and surfaces CWE values without escaping, the malicious value is stored as part of the job/report data.

3. Payload / execution method (vulnerability-class level) When a victim opens the Jenkins UI page that displays the processed Dependency-Check results, the stored, unescaped CWE value is emitted into the HTML response. The browser interprets the injected markup and executes the embedded script within the origin of the Jenkins application. The victim's interaction (viewing the page) satisfies the UI:R precondition in the CVSS vector.

4. Post-exploitation impact Script execution occurs in the victim's authenticated Jenkins session. Typical consequences of stored XSS in this context include session/cookie or token theft, performing actions as the victim (including administrative actions if the victim is privileged), tampering with job configuration, and lateral interaction with other Jenkins features—consistent with the C:H/I:H vector. Per the vector, availability impact is also rated high, though the specific mechanism for availability loss is not detailed in the advisory.

Applicability/uncertainty: The advisory does not enumerate the exact UI location of rendering, the exact report field syntax, or prerequisites such as whether a build must first be executed. Where details are absent, treat the mechanism as "unescaped stored report value rendered to another user"; do not assume undocumented parameters.

Impact Assessment

Business impact: Jenkins is widely used as a CI/CD control plane with access to source code, credentials, build agents, and deployment pipelines. A stored XSS foothold in this context can enable credential theft, unauthorized changes to build logic, and pivot toward downstream environments—raising the stakes well beyond a single user's browser. Affected systems: any Jenkins controller running the OWASP Dependency-Check Plugin at version 5.6.4 or earlier (deployments should verify their installed plugin version). Blast radius: any user who views the impacted report page; the injected script executes in that user's session, so impact scales with the privilege of the viewing user. CVSS subscores per the supplied vector: AV:N (network reachable), AC:L (low attack complexity), PR:L (requires low privileges—Item/Configure), UI:R (victim must interact), S:U (impact scoped to the vulnerable component), C:H/I:H/A:H (high confidentiality, integrity, and availability impact), yielding base score 8.0. Note: EPSS has not yet been scored by FIRST.org; CISA KEV status is NO; no public PoC or Nuclei template is known.

Detection Guidance

Sigma Rule

title: Suspicious Jenkins Dependency-Check Report Upload for Stored XSS (CVE-2026-92136)
id: 8f3a1c2e-6b7d-4e91-9a2c-0d5e7f1b3c44
status: experimental
description: Detects Jenkins job configuration changes or Dependency-Check report uploads that contain HTML/script markup in CWE fields, consistent with CVE-2026-92136 stored XSS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92136
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: jenkins
  service: audit
detection:
  selection_action:
    eventAction:
      - 'config_submit'
      - 'configUpdate'
      - 'uploadedFile'
  selection_payload:
    message|contains:
      - 'CWE-'
    message|re: '(?i)<script|onerror=|onload=|javascript:|<img|<svg'
  condition: selection_action and selection_payload
falsepositives:
  - Legitimate reports containing documentation snippets (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.92136

YARA Rule

rule CVE_2026_92136_Jenkins_DependencyCheck_XSS
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects Dependency-Check reports carrying script markup in CWE fields (CVE-2026-92136)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92136"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cwe = "CWE-" ascii nocase
        $s1 = "<script" ascii nocase
        $s2 = "</script>" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "javascript:" ascii nocase
        $s6 = "<svg" ascii nocase
        $s7 = "<img" ascii nocase

    condition:
        $cwe and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92136 Jenkins Dependency-Check CWE Stored XSS Payload Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"configSubmit"; nocase; http.request_body; content:"CWE-"; nocase; http.request_body; pcre:"/(?i)(<script|onerror=|onload=|javascript:|<svg|<img)/"; reference:cve,2026-92136; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92136; classtype:web-application-attack; sid:202692136; rev:1;)

Elastic Detection

sequence by host.name, user.name with maxspan=10m
  [ any where event.category == "configuration" and
      event.action in ("config_submit", "configUpdate", "uploadedFile") and
      stringContains(message, "CWE-") ]
  [ any where event.category == "web" and
      url.path in ("configSubmit", "jobConfig") and
      stringContains(message, "<script") ]

Splunk SPL Query

index=jenkins sourcetype=jenkins:audit OR sourcetype=jenkins:log
| search ("config_submit" OR "configUpdate" OR "uploadedFile" OR "configSubmit")
| search "CWE-"
| regex _raw="(?i)(<script|onerror=|onload=|javascript:|<svg|<img)"
| stats count values(user) as users values(job_name) as jobs min(_time) as first_seen max(_time) as last_seen by src_ip, host
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| table host, src_ip, users, jobs, count, first_seen, last_seen

Wazuh OSSEC Rule

<group name="jenkins,web,attack,">
  <rule id="2026136" level="12">
    <decoded_as>json</decoded_as>
    <field name="eventAction">config_submit|configUpdate|uploadedFile|configSubmit</field>
    <field name="message">CWE-</field>
    <regex offset="after_parent" type="pcre2">(?i)(&lt;script|onerror=|onload=|javascript:|&lt;svg|&lt;img)</regex>
    <description>CVE-2026-92136: Possible Jenkins Dependency-Check stored XSS via unescaped CWE value (T1190).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92136,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict Item/Configure permission to the smallest possible set of trusted users; stored XSS here requires that permission, so tightening RBAC directly reduces exposure.
• Update the OWASP Dependency-Check Plugin to the latest release available in the Jenkins update center and continue to monitor for a fixed version; no fix is confirmed as of this report.
• Restrict network exposure of the Jenkins controller (VPN/allowlist), reducing the reachable attack surface (AV:N).
• If unable to upgrade, consider temporarily disabling the plugin where its reporting UI is not business-critical.
• Enforce a strict Content Security Policy at the reverse proxy in front of Jenkins to reduce script-execution impact, and ensure session cookies are HttpOnly/SameSite where feasible.

2. Patch / upgrade steps

• There is currently no vendor-confirmed patch. When a fixed plugin version is published, review the Jenkins changelog, take a configuration backup, upgrade the plugin, restart the controller, and validate that CWE values render as escaped text. Because no fix is available, patch confidence remains 0/4.

3. Long-term hardening

• Adopt least-privilege for job configuration and use Jenkins' script/agent security controls to limit blast radius.
• Treat third-party CI/CD plugin output (including report files) as untrusted; where possible, sanitize report inputs before ingestion.
• Deploy WAF/CSP protections and log monitoring (the Sigma/Splunk/Wazuh detections above) to catch injection attempts and post-exploitation activity.
• Maintain an SBOM/plugin inventory and subscribe to Jenkins security advisories to reduce time-to-remediation.

References

• NVD — CVE-2026-92136: https://nvd.nist.gov/vuln/detail/CVE-2026-92136
• Jenkins Security Advisories (vendor): https://www.jenkins.io/security/advisories/
• Jenkins Plugins index (OWASP Dependency-Check Plugin): https://plugins.jenkins.io/dependency-check-jenkins-plugin/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• OWASP — Cross Site Scripting (XSS) / Content Security Policy: https://owasp.org/www-community/attacks/xss/

Threat actor / exploit-in-the-wild note: As of this report, CISA KEV status is NO, no public PoC, exploit code, or Nuclei template is known, and none is attributed to a specific threat actor. Detection content above targets the exploitation pattern rather than known IOCs.